Under European rules (GDPR, ePrivacy), you only need consent here if you both
- access or store information on the user's device (such as cookies), and
- this access/storage is not strictly necessary for a service explicitly requested by the user.
A session cookie is strictly necessary for providing a log-in functionality, so such cookies are unlikely to require consent. In contrast, cookies for measuring ad impressions are not strictly necessary for showing the website content. Necessity must always be thought from the user's perspective, not from the provider's economic needs.
If you use one cookie for multiple purposes, you should analyze each purpose separately. Maybe setting a cookie does not require consent under one purpose, but accessing the same information for a different purpose could require consent.